How serious was the hacking attack on Apple's iPhone?

Wednesday 25 July 2007 19.04 EDT
First published on Wednesday 25 July 2007 19.04 EDT

Certainly not as trivial as many Apple backers suggested. The security company Independent Security Evaluators announced that it had found a way to take over an iPhone by injecting a bit of code through its web browser, causing a "buffer overflow" - which is like a river overflow, but with bits, not water - and thus persuaded it to hand over its recent text messages, Google Maps visits, addresses and phone numbers, and even secretly turn on its microphone so it could act as a bug.

That could be done either through a malicious Wi-Fi network (which redirected you to a fake website when you thought you were going to a trusted one) or via a malicious site that you were tempted to visit one way or another. The problem is that for a handheld computer, and unlike its Mac OS X operating system on its computers, an iPhone runs a very phone-like version of an operating system: every process belongs to the "administrator", which is the person who turns on the phone. "This implies that a compromise of any application gives an attacker full access to the device," the researchers note in a preliminary PDF about the attack (securityevaluators.com). And that's bad.

Apple was told about the flaws on July 17, and has until August 2 to fix them; after that, the exploit will be made public and the million or so iPhones out there will be targets.

But is this a serious flaw? Certainly. It was discovered within three weeks of the phone going on sale, and as more and more people get hold of it - and especially once the method that Independent Security Evaluators used is made public - the attacks will increase. Smartphones, as is obvious from a little reflection, are more handheld computers than phones, and Apple's decision to let this one sync via iTunes - including the transfer of logs detailing how and why any iPhone application crashed - offers would-be hackers a lot more "attack surface" to hammer away at.

Steve Bellovin, a security expert, noted on his blog that: "Yes, it's a security problem; yes, Apple needs to fix it ASAP ... it's not the end of the world, though." His suggestion? "Exercise caution, not paranoia."

For Apple, it's an object lesson in how much more aggressively it is treated on the products that people are gagging to hear about. (By contrast, have you heard of many exploits against the Apple TV? Have you even heard of the Apple TV, which isn't actually a TV?)

But the researchers have more bad news for Apple. As they note on their web page: "It's a near certainty [that there are other vulnerabilities] ... every cause of Safari crashing on the iPhone is a potential vulnerability. And getting Safari on the iPhone to crash isn't that hard. Additionally, it's likely there are vulnerabilities in the other iPhone applications as well."

· If you'd like to comment on any aspect of Technology Guardian, send your emails to tech@theguardian.com